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About Which? 


Which? is the largest consumer organisation in the UK with more than 1.3 million members and 
supporters. We operate as an independent, a-political, social enterprise working for all 
consumers. We are funded solely by our commercial ventures and receive no government 
money, public donations, or other fundraising income. Which?’s mission is to make individuals 
as powerful as the organisations they have to deal with in their daily lives, by empowering them 
to make informed decisions and by campaigning to make people’s lives fairer, simpler and 
safer. 


Introduction 


Which? welcomes the opportunity to respond to the Information Commissioner’s call for 
evidence on an age appropriate design code. The Code will provide guidance on the design 
standards that the Commissioner will expect providers of online ‘Information Society Services’ 
(ISS), which process personal data and are likely to be accessed by children, to meet and is a 
requirement of the Data Protection Act 2018 (the Act). 


Our comments focus on how the Code should deal with issues relating to use of data for 
marketing and specifically, advertising. 


Advertising and Mobile Game pricing 


A recent Which? policy report, Control, Alt or Delete’, explored the world of consumer data and 
highlighted the importance of the digital advertising industry. Digital advertising is the primary 
manifestation of data use to consumers and the concentration of the digital advertising industry 
has driven competitive behaviour that we are only now beginning to understand the 
implications of. This raises particular challenges for the protection of children from inappropriate 
practices. 


In particular, targeted advertising is highly effective which means that there is a need to be 
more vigilant over what advertising children are being exposed to and the impacts of that 
advertising. The Advertising Standards Authority and the ICO guidance on Children and the 
GDPR set out appropriate principles for advertising and digital advertisers often ban targeting 


1 https: / /www.which.co.uk/policy/digitisation/2659/control-alt-or-delete-the-future-of-consumer-data-main-report 
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on the basis of sensitive characteristics and consumer vulnerabilities. However, we are 
concerned that there is insufficient monitoring of the type of adverts children now see. In 
particular, the use of algorithms to determine adverts may identify characteristics correlated 
with vulnerabilities and we are not convinced that companies are doing enough to satisfy 
themselves that this is not occurring. 


It is extremely important, therefore, that there is good monitoring of the type of adverts seen 
by children and how they differ based on the data held by companies, so that the type of 
targeted advertising that is being directed towards children can be properly understood. This 
will allow the ICO and the advertising industry to understand how the principles are interpreted 
in practice and to focus on those practices that could cause harm and are widespread. 


The use of personal data within the pricing models of mobile games are another area of 
concern. We have highlighted evidence that app developers have tested using personal data to 
try different pricing for in-app purchases’, and there are at least two companies actively 
offering such services. We are concerned that if games are actively using data for this purpose, 
it is not transparent and the impacts are poorly understood. It is therefore very difficult to 
understand what children are currently being exposed to — and for parents or guardians to 
police this. 


Food advertising 


Which? has long campaigned for effective controls over the marketing of unhealthy foods (ie. 
foods that are high in fat, sugar or salt (HFSS) to children. The Department of Health and Social 
Care (DHSC) recently published a Childhood Obesity Charter (Chapter 2)? which set out a range 
of measures to try to tackle the UK’s high rates of childhood obesity. This recognised that the 
evidence shows exposure to food advertising can have both an immediate and longer-term 
impact on children’s health, by encouraging greater consumption immediately after watching 
the advert and altering children’s food preferences and that effects are significant and 
independent of other influences. The Government has therefore committed to introducing 
further controls over digital advertising of HFSS foods to children, along with tighter TV 
advertising restrictions. 


It is important that the Age Appropriate Design Code is consistent with the aims of the 
Childhood Obesity Charter and includes provisions relating to the use of children’s data for this 
type of advertising, which raises concerns for children’s health protection — in addition to the 
wider protection they need because of their vulnerability. These protections need to apply to 
children up to 16, consistent with Ofcom advertising restrictions on advertising of HFSS foods to 
children. 


The current guidance issued by the ICO on children and the GDPR does include marketing and 
states that when considering marketing, children’s reduced ability to recognise and critically 
assess the purposes behind the processing and the potential consequences of providing their 
personal data should be taken into account. The guidance also makes reference to sector 
specific guidance on marketing, such as that issued by the Advertising Standards Authority, to 


? VentureBeat, (2015), Cut the rope 2 gets more in-app spenders by using Gondola’s dynamic pricing: https: // 
venturebeat.com/2015/12/15/cut-the-rope-2-gets-more-in-app-spenders-by-using-gondolas-dynamic-pricing 
3 https: / /www. gov.uk/government/publications /childhood-obesity-a-plan-for-action-chapter-2 
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make sure that children’s personal data is not used in a way that might lead to their 
exploitation. 


The Code, however, needs to be based on a more in-depth understanding of the sophisticated 
and integrated approaches that are now practiced to ensure that it provides sufficient 
protection — including understanding the extent to which algorithms and apps for example, as 
referred to above, are already being used by food companies - and also recognise that 
regardless of children’s ability to critically assess the purposes behind provision of their data, 
they will still need to be protected. 


Data Security and Connected Devices aimed at children 


For consumers to use digital products and services with confidence they need the reassurance 
that their data is secure. As relatively vulnerable consumers and users of digital products and 
services, children’s online protection should be a priority for governments, retailers and 
manufacturers. Our testing and research on connected toys* has found a range of data security 
risks and Consumers International have highlighted further problems in internet-connected 
children’s products’. 


The ICO should consider in detail the implications of how children use connected toys and other 
devices, including in particular the security of the data that the devices collect and use. We 
have been working closely with Government on establishing a Code of Practice for Security by 
Design® and would strongly encourage the ICO to consider the implications of this Code of 
Practice for connected devices aimed at children when considering the Age Appropriate Design 
Code. 


4 https: / /www. which.co.uk/reviews /smart-toys /article/smart-toys-should-you-buy-them 
> https: / /www.consumersinternational.org/what-we-do/consumer-protection/safer-products/connected-toys/ 
é https: / /www. gov.uk/government/publications /secure-by-design 


